Cookie Policy

This Cookie Policy explains, in as much detail as is reasonably possible, how Road Lux Ltd (company number 08837891), of Kamp House, 124 Middleton Road, Morden, England, SM4 6RW ("RoadLux Vehicle Check", "RoadLux", "we", "us" or "our"), uses cookies and similar technologies on and in connection with check.roadlux.uk and any related subdomains, applications, embedded widgets or emails (together, the "Service").

This policy applies to every visitor to the Service, whether or not you create an account, purchase a vehicle history check, or simply browse our pages. It applies regardless of the device you use — desktop, laptop, tablet or mobile — and regardless of the browser you use to access us.

This Cookie Policy should be read alongside our Privacy Policy and our Terms of Service. Where cookies involve the processing of personal data, our Privacy Policy governs how that personal data is used, shared and protected; this Cookie Policy focuses specifically on the mechanics of cookies themselves — what they are, which ones we use, why, and how you can control them.

By continuing to use the Service after being presented with our cookie banner and making a choice, you agree to this policy insofar as it describes cookies you have consented to. You can change your mind at any time using the controls described in section 16.

A cookie is a small text file — typically a few kilobytes or less — that a website asks your browser to store on your device when you visit. The cookie contains a piece of information, often a unique identifier, that the website can read back on later visits, or during the same visit as you move between pages.

Cookies were originally developed in the mid-1990s to solve a simple problem: the web's underlying protocol (HTTP) does not, by itself, remember anything about you between one page request and the next. Cookies allow a website to "remember" that you are logged in, that you have items in a basket, that you have already dismissed a notice, or that you prefer a particular language or currency.

Key characteristics of a cookie

• It is set by a web server or by client-side script running in your browser.
• It is stored locally on your device, not on our servers.
• It is sent back to the originating domain (or, for third-party cookies, to the third-party domain) on subsequent requests.
• It has a name, a value, a domain, a path, and an expiry date or session lifetime.
• It can be flagged as "secure" (HTTPS only) and "HttpOnly" (inaccessible to JavaScript) to improve security.

Cookies cannot, by themselves, run programs, deliver viruses, or extract files from your device. They are simply pieces of text. However, when combined with server-side processing, cookies can be used to build a picture of your behaviour across a site or, in the case of third-party advertising cookies, across many sites.

When your browser requests a page from check.roadlux.uk, our server (or a script running in your browser) may respond with an instruction to store a cookie. Your browser stores that cookie in a protected area of your device associated with our domain. On every subsequent request to the same domain, your browser automatically attaches the relevant cookies to the request headers, allowing the server (or client-side script) to recognise you.

A worked example

Suppose you begin a vehicle check on our site. We set a session cookie so that, as you move from entering your registration number, to viewing the report summary, to the payment page, our system can keep track of which check you are paying for without asking you to re-authenticate on every page. Without this cookie, each page load would look like a brand new, anonymous visitor, and features such as shopping baskets, login sessions and multi-step forms would not work reliably.

Reading and writing cookies

• Server-set cookies are sent using the Set-Cookie HTTP response header.
• Client-set cookies are created using JavaScript running in your browser (for example, by an analytics tag).
• Cookies are scoped to a domain and path, meaning a cookie set for check.roadlux.uk cannot normally be read by an unrelated website.
• Cookie attributes such as SameSite restrict whether a cookie is sent on cross-site requests, which helps prevent certain attacks.

"Cookies" is often used as shorthand for a broader family of technologies that store or access information on your device. In the interests of transparency we describe each of these below, and we are explicit about which ones we do and do not deploy.

Technologies we may use

• Local storage: a browser API that allows a small amount of data to persist on your device indefinitely, until cleared. We may use local storage to remember interface preferences and to cache non-sensitive report data temporarily to speed up page loads.
• Session storage: similar to local storage, but cleared automatically when you close the browser tab. We use this to hold in-progress form data (such as a partially entered registration number) so it survives a page refresh.
• Software development kits (SDKs): our payment provider, Stripe, supplies a client-side SDK that may set cookies and use device signals for fraud prevention purposes, as described in section 10.

Technologies we do not use

• Tracking pixels or web beacons embedded in marketing emails to track whether you have opened an email.
• Device fingerprinting that attempts to identify your device using a combination of browser and hardware characteristics without storing an identifier.
• Cross-site advertising retargeting tags from third-party ad networks.
• Social media "like" or "share" buttons that load third-party tracking scripts.

If this changes in the future — for example, if we introduce a marketing pixel — we will update this policy, seek any consent required by law, and reflect the change in our cookie consent banner before the technology is activated.

We use cookies and similar technologies for the following broad purposes:

• To make the Service function correctly, including keeping you signed in and letting you complete a purchase.
• To protect the Service and our users from fraud, abuse and security threats.
• To remember choices you have made, such as your cookie preferences or display settings.
• To understand, in aggregate, how visitors use our Service so that we can identify and fix problems and improve the experience.
• To measure the effectiveness of any marketing activity, where you have consented.

We do not use cookies to sell your personal data, and we do not permit third parties to use cookies on our Service to build advertising profiles about you without your consent.

Our use of cookies is governed principally by two pieces of UK law that work together: the Privacy and Electronic Communications Regulations 2003 (PECR), and the UK General Data Protection Regulation together with the Data Protection Act 2018 (UK GDPR).

PECR

PECR sets out specific rules on the use of cookies and similar technologies. In summary, PECR requires that, other than for cookies which are "strictly necessary" for a service you have explicitly requested, we must (a) tell you clearly and comprehensively about the cookies we intend to use, and (b) obtain your consent before we store or access those cookies on your device.

UK GDPR

Where a cookie involves processing personal data — for example, an analytics cookie that creates a unique identifier we could combine with other data — the UK GDPR applies to that processing. This means we must have a lawful basis for the processing (in most non-essential cases, your consent), and must comply with data protection principles such as purpose limitation, data minimisation and storage limitation.

The Information Commissioner's Office (ICO) is the UK's independent regulator for both PECR and UK GDPR, and its guidance informs the design of our consent mechanisms described in section 16.

We categorise every cookie on our Service into one of four categories, each with its own consent treatment and, where personal data is involved, its own lawful basis under UK GDPR.

Consent, where required, must be freely given, specific, informed and unambiguous, expressed through a clear affirmative action. We do not use pre-ticked boxes, and we do not treat continued browsing as consent. You can accept, reject or customise your choices before any non-essential cookie is set, and you can withdraw consent at any time as described in section 16.

Strictly necessary cookies are essential to deliver the Service you have asked for — for example, to let you move through the vehicle-check purchase flow, to keep your session secure, or to remember that you have already responded to our cookie banner. Because these cookies are indispensable to providing the service you request, PECR does not require consent for them, although we still tell you about them here for transparency.

You cannot opt out of strictly necessary cookies through our consent banner, because doing so would prevent the Service from functioning. You can still block them at browser level, but the Service is likely to break — see section 20.

Preference cookies remember choices you make so we do not need to ask you again on every visit. They make the Service more convenient but are not essential to its core operation, so we only set them with your consent.

Analytics cookies help us understand how visitors interact with the Service in aggregate — which pages are most visited, where visitors encounter errors, and how long a typical check takes to complete. This data helps us prioritise improvements. We only run analytics cookies once you have given consent, and we configure our analytics tooling to minimise the personal data collected (for example, by truncating IP addresses where technically supported).

Where we use Google Analytics, data may be transferred to and processed by Google outside the UK; see section 10 and our Privacy Policy for details of the safeguards that apply to such transfers.

Marketing cookies, where used, help us measure the effectiveness of advertising campaigns and avoid showing you repetitive or irrelevant adverts. We currently make limited use of marketing cookies, and only ever with your prior consent. If you decline, you may still see adverts for RoadLux elsewhere on the web, but they will not be tailored to your activity on our Service.

We do not use these cookies to build profiles for sale to third parties, and we do not share this data with data brokers.

Some cookies on the Service are placed not by us, but by third parties whose services we embed, most notably our payment processor. Third parties set their own cookies subject to their own privacy and cookie policies, which we encourage you to review.

Stripe

We use Stripe, Inc. and its affiliates to process card payments securely and to detect and prevent fraudulent transactions. Stripe's checkout and fraud-detection components may set cookies and use device data as part of their machine-learning fraud models. These cookies are considered strictly necessary to enable secure payment processing for a transaction you have initiated, and further detail is available in Stripe's own cookie and privacy documentation.

Analytics and advertising providers

As set out in sections 12 and 13, we may use Google Analytics and Google Ads, both operated by Google LLC / Google Ireland Limited. These providers act as independent controllers or processors in relation to the data collected via their cookies, depending on configuration, and their own privacy policies apply to that processing in addition to ours.

A first-party cookie is set by the domain you are visiting — in our case, check.roadlux.uk — and can normally only be read by that domain. A third-party cookie is set by a domain other than the one shown in your address bar, typically because a page embeds content, a script or an iframe from that other domain.

• First-party cookies we set ourselves are used for session management, security, preferences and first-party analytics.
• Third-party cookies arise from embedded services such as Stripe's payment element or Google's analytics and advertising tags.

Modern browsers increasingly restrict third-party cookies by default (for example, Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection). This can affect the accuracy of analytics and, occasionally, the smoothness of embedded payment flows, but it does not affect our first-party strictly necessary cookies.

Cookies can also be classified by how long they last, independent of who sets them.

Session cookies

Session cookies exist only for the duration of your browser session and are automatically deleted when you close your browser (or, on some mobile browsers, when the app is fully closed rather than backgrounded). We use session cookies for core functionality such as keeping track of an in-progress purchase.

Persistent cookies

Persistent cookies remain on your device for a fixed period — anywhere from a day to a couple of years — set at the time the cookie is created, and survive browser restarts. We use persistent cookies to keep you signed in between visits, remember your cookie consent choice, and support analytics reporting over time.

Every cookie we or our providers set has a defined maximum lifetime, sometimes referred to as its expiry. Once that period elapses, the browser automatically deletes the cookie, and (in most cases) a fresh one will be set the next time you visit and it is needed again.

We keep cookie durations as short as reasonably practicable for their purpose and periodically review these periods, in line with the storage limitation principle under UK GDPR.

When you first visit check.roadlux.uk, we display a cookie banner that explains our use of cookies and offers you three clear choices: "Accept all," "Reject non-essential," and "Manage preferences." No analytics, preference or marketing cookie is set until you make a choice, other than the strictly necessary cookies described in section 9 which are required to display and remember the banner itself.

Selecting "Manage preferences" opens a panel where you can switch each non-essential category on or off individually, read a short description of what each category does, and see example cookies within it. Your selection is then recorded via the rl_consent cookie described in section 9, so we do not need to ask again on every page.

You can change your mind at any time. To update your cookie preferences on check.roadlux.uk:

• Look for the "Cookie preferences" link in the footer of any page and open the preference panel.
• Toggle each category on or off and select "Save preferences."
• Alternatively, clear the rl_consent cookie via your browser settings; the banner will reappear on your next visit.
• You can also email info@roadlux.uk and ask us to reset your recorded preference, although browser-level changes take effect immediately whereas email requests may take a short time to process.

Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it, and does not affect strictly necessary cookies, which remain in place to keep the Service functioning.

In Chrome, open the menu (three dots, top right), select "Settings," then "Privacy and security," then "Cookies and other site data." From here you can view, block or delete cookies, block third-party cookies entirely, or set Chrome to clear cookies every time you close the browser. You can also click the padlock or tune icon in the address bar of any page, including check.roadlux.uk, to view and delete cookies set by that specific site.

In Safari on macOS, open "Safari," then "Settings" (or "Preferences" on older versions), then the "Privacy" tab, where you can manage "Prevent cross-site tracking" and view or remove stored website data. On iOS and iPadOS, open the Settings app, scroll to "Safari," and use the "Advanced" and "Privacy & Security" sections to manage cookies and website data, including removing data for individual sites.

In Firefox, open the menu, select "Settings," then "Privacy & Security." Under "Enhanced Tracking Protection" you can choose Standard, Strict or Custom protection levels, and under "Cookies and Site Data" you can view, search, remove or block cookies, including setting Firefox to clear cookies automatically when it closes.

In Edge, open the menu (three dots), select "Settings," then "Cookies and site permissions," then "Manage and delete cookies and site data." From here you can block third-party cookies, see all cookies currently stored, and delete cookies for specific sites such as check.roadlux.uk.

If you access the Service through a mobile browser, the browser-specific instructions above generally apply to the mobile version of that browser too (for example, Chrome for Android or Safari for iOS). In addition:

• iOS and iPadOS let you limit ad tracking and manage app-level tracking permissions under Settings > Privacy & Security > Tracking.
• Android lets you reset or delete your advertising identifier and adjust ad personalisation under Settings > Privacy > Ads.
• Clearing your mobile browser's cache and site data will remove cookies stored by check.roadlux.uk on that device.

Some browsers and extensions send a "Do Not Track" (DNT) header or a "Global Privacy Control" (GPC) signal, indicating that you do not wish to be tracked across the web. There is currently no single agreed legal or technical standard for how websites must respond to DNT, and it is not yet universally supported.

We are working to recognise the Global Privacy Control signal as an indication that you wish to reject non-essential cookies, and where technically able to detect it, we will treat a GPC signal as equivalent to declining preference, analytics and marketing cookies. Regardless of whether your browser sends such a signal, you can always use our cookie preference panel described in section 16 to make your choice explicit.

Disabling or deleting cookies can affect how the Service works. In particular:

• Blocking strictly necessary cookies is likely to prevent you from signing in, completing a vehicle check, or making a payment.
• Blocking preference cookies means we will not remember settings such as your preferred units, so you may need to reselect them on each visit.
• Blocking analytics cookies has no effect on your ability to use the Service, but means your visit will not be reflected in the data we use to improve it.
• Blocking marketing cookies has no effect on your ability to use the Service, but any adverts you see elsewhere will be less tailored to your interests.

If you experience problems using the Service, checking your cookie settings and ensuring first-party cookies for check.roadlux.uk are allowed is a good first troubleshooting step before contacting support.

Some cookies, particularly the rl_auth authentication cookie and analytics identifiers, are linked to or capable of being linked to personal data — for example, your account details or your IP address. Where this is the case, the data collected via cookies is processed in accordance with our Privacy Policy, which explains in full what personal data we collect, why, on what legal basis, how long we keep it, who we share it with and what rights you have (such as the rights to access, correct, delete or object to processing of your personal data).

Purely anonymous or aggregated cookie data — data that cannot reasonably be linked back to an identifiable individual — falls outside the scope of the UK GDPR, but we still describe it here in the interests of full transparency.

We keep a record of the consent choice you make (or that a GPC signal indicates), together with the date and version of this Cookie Policy in force at the time, so that we can demonstrate compliance with PECR and UK GDPR if required to do so by the ICO or in the event of a dispute. This consent record is itself stored in the rl_consent cookie and, where you hold an account, may also be logged on our servers for a limited period, generally no longer than 24 months, after which it is refreshed by asking for your preference again.

The Service is intended for use by adults arranging vehicle history checks, and is not directed at children. We do not knowingly set marketing or advertising cookies with the purpose of targeting children, and we do not knowingly collect personal data from children through cookies. If you believe a child has provided us with personal data via the Service, please contact us at info@roadlux.uk so we can address it.

We may update this Cookie Policy from time to time to reflect changes in the cookies and technologies we use, changes in the law, or changes recommended by regulators such as the ICO. Where changes are material — for example, the introduction of a new category of marketing cookie — we will refresh our consent banner so that you are asked to make a fresh choice before any new non-essential cookie is set. The "Last updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this page periodically.

If you have any questions about this Cookie Policy or about how we use cookies, please contact us at info@roadlux.uk or write to Road Lux Ltd, Kamp House, 124 Middleton Road, Morden, England, SM4 6RW.

If you are unhappy with our response, or believe we have not complied with PECR or UK GDPR in relation to cookies, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection and privacy and electronic communications, via ico.org.uk or by calling their helpline. We would, however, appreciate the opportunity to address your concerns directly first.